From 1efe7e2d15e2b10029d7893a63f142892a791e65 Mon Sep 17 00:00:00 2001
From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com>
Date: Fri, 23 Jan 2026 17:28:19 -0600
Subject: ssh

---
 modules/services/nixos/ssh.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

(limited to 'modules/services/nixos')

diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix
index cfe7883..7868a31 100644
--- a/modules/services/nixos/ssh.nix
+++ b/modules/services/nixos/ssh.nix
@@ -8,7 +8,6 @@ in {
   config = lib.mkIf cfg.enable {
     services.openssh = {
       enable = true;
-      openFirewall = false;
       hostKeys = [
         {
           path = "/etc/ssh/ssh_host_ed25519_key";
@@ -24,9 +23,15 @@ in {
       ];
 
       settings = {
-        PermitRootLogin = "prohibit-password";
+        PermitRootLogin = "prohibit-password"; # deploy-rs uses root account
         PasswordAuthentication = false;
       };
+
+      knownHosts = {
+        "mercury".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIQtMAgPdWwrOzlZT/lEIRQZ+ajhafG9AEJCrF2/bsmN";
+        "jupiter".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPB7feUHl5qoD5zF9AMOV2meViA+wZYdVvbVjPkggZf8";
+        "ganymede".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlr+53UmlGVP1blkdNl6NFqn1w2umFJyjH1EVUPKIy9";
+      };
     };
 
     systemd.services."openssh" = lib.mkIf config.collinux.services.networking.networkd.enable {
-- 
cgit v1.3.1